Next.js - SSRF (CVE-2024-34351)

CVE-2024-34351 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in self-hosted Next.js applications using Server Actions. By modifying the Host header under specific redirect conditions, unauthenticated attackers may cause requests to originate from the application server, potentially accessing internal services and sensitive information. The issue is fixed in Next.js 14.1.1.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.

CrowdSec network data shows that most actors exploiting CVE-2024-34351 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-34351 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target the Next.js image optimization endpoint /_next/image, supplying the url parameter with an attacker-controlled HTTP or HTTPS resource to make the server perform an outbound request. Detection should correlate requests to this endpoint with external interaction and responses such as “The requested resource isn't a valid image.”